Changes in the processing of personal data from September 1, 2025
A brief overview of changes in personal data protection legislation that came into force on September 1, 2025.
Overview of personal data processing disputes in 2025
The year 2025 marked a shift in the trend toward stricter regulation of personal data processing. New rules, prohibitions, and restrictions were introduced, and enforcement became more rigorous.
Read more
New requirements for localization of personal data in Russia: changes from July 2025 and implications for business
On July 1, 2025, a new version of paragraph 5 of Article 18 of Federal Law No. 152 “On Personal Data” will come into force.
Read more
Analysis of personal data processing practices: trends and important insights
Read more
Increased fines for violations in processing of personal data
Federal Law No. 589-FZ from 12.12.2023 "On Amending the Code of Administrative Offenses of the Russian Federation" has been adopted.
Starting from December 23, 2023, fines for processing personal data without the written consent of the subject of personal data or in violation of the requirements for its execution are increased.
Preparation of a full package of documents on personal data protection, registration with Roskomnadzor
Client
Large company. Business activities:
- Wholesale of non-specialized food, beverages and tobacco products
- Wholesale of industrial chemicals
Objectives
- Development of a full package of documents on personal data from scratch
- Registration of the company with Roskomnadzor taking into account the new requirements for cross-border transfer of personal data
- Visit to the client and verification of proper storage of documents on personal data of both employees and counterparties. applicants
- Checking the access system at the entrance to the back offices for compliance with 152-FZ
Work stages
- Verification of all existing forms of personal data documents;
- Visit to the client, verification of proper storage of personal data documents, including in case of non-automated processing of employees' personal data;
- Negotiations with the client and choice of strategy in interaction with counterparties - individuals, sole proprietors for compliance with the norms of 152-FZ in terms of obtaining consents for processing of personal data;
- Checking the pass system and internal regulations reflecting the system of issuing passes for the company's employees;
- Development of a full package of documents taking into account the new forms of consent according to the latest amendments to the 152-FZ;
- Registration of the company with Roskomnadzor as an operator for processing personal data, taking into account the specifics of cross-border transfer of personal data.
Audit of the organization's internal regulations on personal data for compliance with 152-FZ
Client
Major international manufacturer of electrical and electronic equipment for motor vehicles, manufacturer of parts and accessories for motor vehicles. Activities:
- carrying out maintenance and repair of passenger cars
- trade in automobile parts, assemblies and accessories
Objective
Verification of internal regulations in the field of personal data taking into account the latest amendments and additions to the 152-FZ, indicating shortcomings, recommendations for elimination.
Project stages
- carrying out a detailed review of local normative acts on personal data, as well as consent forms
- analysis of violations and inconsistencies identified, taking into account all amendments to the 152-FZ
- identification of missing forms, recommendations on their development
- preparation of the final report on all identified shortcomings, amendments, description of the wording that reduces the risks of bringing the personal data processing Operator to liability, including to reduce the risks of Roskomnadzor inspection
Result – report on all identified violations and suggestions for corrections and additions.
Risks of acquisition and use of databases containing personal data of potential customers
It is not uncommon for entrepreneurs to consider using databases of potential customers in their commercial activities. There are many different offers on the market to buy and sell databases of personal data, but when buying them, it is worth considering the legislation on personal data and its application to the buyer of such data. Let us consider the main problems that a buyer of personal data bases may face.
Read more
Placement of biometric personal data in the Unified Biometric System
In August 2023, MFCs (Public Service Centers) unexpectedly faced a rush of citizens' demand for the service of registration of refusal to collect biometric personal data. The reason is the rumors spreading that if you do not submit the appropriate application by 31.08.2023, biometric data of citizens will begin to collect uncontrolled by various organizations, primarily banks and telecom operators.
Read more
Changes regarding personal data from March 1, 2023: new document forms, requirements of Roskomnadzor, and necessary actions for personal data operators
Until March 1, 2023, employers are required to submit special notifications to Roskomnadzor (hereinafter referred to as RKN) regarding the processing of personal data.
Read more